> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

## 1.41.3

**`(chore):`** Patch `/usr/local/go/src/go.mod`, `vendor/modules.txt`, and `go.sum` in
the go-sdk + go-model containers so they declare `golang.org/x/net
v0.53.0`. Go 1.26.3 already ships the CVE-2026-33814 fix in its bundled
`h2_bundle.go` (the HTTP/2 SETTINGS\_MAX\_FRAME\_SIZE validation moved to
the top of `ForeachSetting`), but the stdlib SBOM still pins the
pre-fix x/net pseudo-version `v0.47.1-0.20260417*`. Bumping the SBOM
metadata to v0.53.0 makes grype reflect the patched code instead of
flagging the toolchain as vulnerable.